CVE-2026-81911

Undergoing Analysis Undergoing Analysis - In Progress

Stored XSS in Concrete CMS Board Custom Slot

Publication date: 2026-09-11

Last updated on: 2026-09-18

Assigner: ConcreteCMS

Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the target board instance (canEditBoardContents()) and then persists the client-supplied selectedTemplateOption[collection] verbatim, rather than rebuilding the content object collection server-side and verifying that each item belongs to the authorized board's data pool. A user with permission to edit the contents of at least one board instance can therefore store a forged summary object whose description field carries a JavaScript-bearing HTML payload. The default summary template renders the description field without output encoding, so the payload executes in the browser of any user who views the affected board slot, including anonymous front-end visitors and dashboard users who preview the resulting rule or block. This can enable session or action takeover and escalation toward an administrator. Concrete CMS versions below 9 do not include the Boards feature and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.8 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-18

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-81911

EUVD

EUVD-2026-76447

Affected Vendors & Products

Vendor	Product	Version / Range
concretecms	concrete_cms	From 9.0.0 (inc) to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in Concrete CMS versions 9.0.0 to 9.5.2. It allows a user with edit permissions on a board instance to inject malicious JavaScript into the description field of a summary object. The payload executes when others view the affected board slot due to lack of output encoding.

Detection Guidance

To detect this vulnerability, inspect Concrete CMS installations running versions 9.0.0 to 9.5.2 for unauthorized JavaScript payloads in board custom slot descriptions. Check server logs for requests to the custom_slot/save_template endpoint with suspicious template content. Review board slot templates for unencoded HTML in description fields.

Impact Analysis

An attacker could take over user sessions, perform unauthorized actions, or escalate privileges to administrator level. Even anonymous visitors viewing the board slot could be affected. The vulnerability enables session or action takeover.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in user browsers. This may lead to session hijacking, data theft, or unauthorized actions, which could violate data protection requirements under these regulations.

Mitigation Strategies

Upgrade Concrete CMS to a version above 9.5.2 to address the Stored XSS vulnerability in the Board Custom Slot dialog. Ensure no custom templates contain malicious JavaScript payloads in the description fields of summary objects.

Hi! I’m here to help you understand CVE-2026-81911. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70